CVE-2024-9439: SuperAGI Remote Code Execution Vulnerability

CVE-2024-9439 Overview

CVE-2024-9439 is a remote code execution vulnerability in SuperAGI, an open-source autonomous AI agent framework. The agent template update API accepts attacker-controlled parameters that flow into a Python eval call without sanitization or validation. An authenticated attacker with low privileges can inject arbitrary Python expressions, leading to code execution in the SuperAGI process context. Successful exploitation results in full system compromise, including access to agent credentials, connected API keys, and underlying host resources. The issue is classified under CWE-94: Improper Control of Generation of Code.

Critical Impact
Authenticated attackers can achieve remote code execution through the agent template update API, resulting in full compromise of the SuperAGI host and any credentials it holds.

Affected Products

SuperAGI 0.0.14
SuperAGI open-source autonomous agent framework
Deployments exposing the agent template update API endpoint

Discovery Timeline

2025-03-20 - CVE-2024-9439 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-9439

Vulnerability Analysis

SuperAGI exposes an API for updating agent templates. Parameters submitted to this endpoint are passed directly to Python's eval function without input validation or allow-list enforcement. Because eval executes arbitrary Python expressions, any string an attacker supplies becomes executable code inside the SuperAGI process.

The vulnerability requires network access to the API and a low-privilege authenticated session. No user interaction is needed. Once triggered, the attacker inherits the privileges of the SuperAGI runtime, which typically holds credentials for large language model providers, vector databases, and external tool integrations.

The impact extends beyond the application. Because SuperAGI orchestrates agents that execute tools and shell operations, code injected through eval can pivot into the operating system, exfiltrate secrets stored in environment variables, and tamper with agent workflows.

Root Cause

The root cause is the use of eval on unsanitized user input inside the template update handler. The application treats template parameters as trusted data. It performs no type checks, no expression parsing, and no restriction on callable objects available to the evaluated expression.

Attack Vector

An authenticated attacker sends a crafted request to the agent template update API with a malicious payload in a parameter that is later evaluated. The payload can invoke built-in functions such as __import__('os').system(...) to spawn a shell, read files, or establish outbound network connections. Further technical detail is available in the Huntr Security Bounty report.

Detection Methods for CVE-2024-9439

Indicators of Compromise

Unexpected outbound network connections initiated by the SuperAGI process to attacker-controlled hosts.
Child processes spawned by the SuperAGI Python interpreter, such as /bin/sh, bash, or curl.
New or modified agent templates containing Python expressions referencing __import__, os, subprocess, or eval.
Access to sensitive files or environment variables shortly after agent template update API calls.

Detection Strategies

Inspect application and reverse-proxy logs for POST or PUT requests to the agent template update endpoint containing suspicious characters such as backticks, parentheses, or Python keywords.
Alert on process-lineage anomalies where the SuperAGI service becomes a parent of shell interpreters or network utilities.
Correlate authenticated API activity with unusual template modifications to identify low-privilege accounts pivoting to code execution.

Monitoring Recommendations

Forward SuperAGI application logs, reverse-proxy access logs, and host process telemetry to a centralized analytics platform for correlation.
Monitor filesystem writes to template storage locations and database rows representing agent templates.
Track credential and API key usage originating from the SuperAGI host to detect post-exploitation abuse.

How to Mitigate CVE-2024-9439

Immediate Actions Required

Restrict network exposure of SuperAGI to trusted administrators using firewall rules or a private network segment.
Disable or gate the agent template update endpoint until a patched release is deployed.
Rotate any API keys, model provider tokens, and database credentials held by the SuperAGI instance.
Review recent template changes and agent execution logs for signs of exploitation.

Patch Information

No vendor advisory or fixed version is listed in the NVD entry at the time of writing. Operators should track the upstream SuperAGI project and the Huntr Security Bounty report for a remediated release. Until a patched version is available, apply the workarounds below.

Workarounds

Place SuperAGI behind an authenticating reverse proxy that enforces IP allow-listing and strong administrator authentication.
Run SuperAGI as an unprivileged user inside a container with a read-only filesystem and no outbound internet egress except to required APIs.
Apply a local patch that replaces the eval call in the template update handler with ast.literal_eval or a strict schema validator.
Remove or restrict template parameters that are not required for your deployment to reduce attack surface.

bash

# Configuration example: restrict SuperAGI to localhost and drop external traffic
iptables -A INPUT -p tcp --dport 3000 -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 3000 -j DROP

# Run the container as non-root with a read-only filesystem
docker run --read-only --user 1000:1000 \
  --cap-drop=ALL --network=internal_only \
  -p 127.0.0.1:3000:3000 superagi/superagi:latest